So going back to Sam now, we wanna look at how do you prepare for a successful audit or certification process?

Yep.

So there are multiple documented information requirements that companies consider when they're looking at implementing some sort of framework, either SOC 2 audit, ISO 27001.

So we'd always start with looking at what the company already has.

If they have a documentation that's reflective of the current processes or their, their technical control requirements, and then look to enhance or, or kind of tweak those, those policies for, for, for sort of standard or framework compliance.

So yeah, looking at what the, the company's already got, creating a set of policy documents that define clearly company requirements and what's required of employees, company stakeholders, those types of individuals.

Companies, or, or we're seeing more and more that businesses are going down the gap analysis route rather than direct to implementation in, in certain instances.

We'll get there." And then in that situation, we normally get them their report certificate three to seven days after the stage t- stage two audit finishes because they sort of match our speed, and we match them, and we wanna get them over the line.

So, Sam, I'll let you take that one away.

Yeah, of course.

So 27001 and SOC 2 sit in a similar space, I suppose.

There are, uh, a lot of elements that overlap in both frameworks.

There are some sort of distinct differences as well.

So in terms of similarities, well, first of all, they're both IT-based frameworks, but they're both risk-based.

So step one for, for implementation of either framework is to identify risks to the business and then select suitable controls that are compliant with, with framework requirements, implement them, and then monitor them to ensure that they're running appropriately, consistently, and, and delivering sort of the, the right outputs really.

So what we think to that?